CVE-2019-4638 LOW

CVE-2019-4638

Vendor Ibm
Product Security Secret Server
Published January 28, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.0/A:N/S:U/PR:N/UI:N/AC:H/I:N/C:L/AV:N/RL:O/E:U/RC:C

What the vulnerability does

01Description

IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 170044.

Key dates

02Disclosure timeline

January 28, 2020 CVE published
September 16, 2024 Record updated